The UEFI Specification version 2.1, published Jan. 23, 2007 specifies a Unified Extensible Firmware Interface (UEFI) that provides a software interface between an operating system (OS) and platform firmware of a computing device. The interface defined by the UEFI specification includes data tables which contain platform information, and boot and runtime services which are available to the operating system (OS) loader and the operating system. The UEFI defines boot services, which include text and graphical console support on various devices, bus, block and file services, and runtime services, such as date, time and NVRAM services. Moreover, UEFI Platform Initialization Specification (PI) Version 1.0—released Oct. 31, 2006, defines the firmware interface for chipset initialization.
The open format of the Unified Extensible Firmware Interface allows platform supplier, driver authors, and other software suppliers to create application program interfaces or “protocols” for use with the Unified Extensible Firmware Interface. However, the “extensibility” of the Unified Extensible Firmware Interface also creates a larger attack surface and opportunity for the injection of malware into the platform through unprotected application program interfaces.